CVE-2010-0013

7.5 HIGH
Published: January 09, 2010 Modified: April 23, 2026
View on NVD

Description

Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://d.pidgin.im/viewmtn/revision/info/3d02401cf232459fc80c0837d31e05fae7ae5467
Source: secalert@redhat.com
Broken Link
http://d.pidgin.im/viewmtn/revision/info/4be2df4f72bd8a55cdae7f2554b73342a497c92f
Source: secalert@redhat.com
Broken Link
http://d.pidgin.im/viewmtn/revision/info/c64a1adc8bda2b4aeaae1f273541afbc4f71b810
Source: secalert@redhat.com
Broken Link
http://developer.pidgin.im/viewmtn/revision/diff/3d02401cf232459fc80c0837d31e05fae7ae5467/with/c64a1adc8bda2b4aeaae1f273541afbc4f71b810/libpurple/protocols/msn/slp.c
Source: secalert@redhat.com
Broken Link
http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.html
Source: secalert@redhat.com
Product
http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033771.html
Source: secalert@redhat.com
Mailing List
http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033848.html
Source: secalert@redhat.com
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
Source: secalert@redhat.com
Mailing List
http://secunia.com/advisories/37953
Source: secalert@redhat.com
Broken Link Vendor Advisory
http://secunia.com/advisories/37954
Source: secalert@redhat.com
Broken Link Vendor Advisory
http://secunia.com/advisories/37961
Source: secalert@redhat.com
Broken Link
http://secunia.com/advisories/38915
Source: secalert@redhat.com
Broken Link
http://sunsolve.sun.com/search/document.do?assetkey=1-66-277450-1
Source: secalert@redhat.com
Broken Link
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1022203.1-1
Source: secalert@redhat.com
Broken Link
http://www.mandriva.com/security/advisories?name=MDVSA-2010:085
Source: secalert@redhat.com
Broken Link
http://www.openwall.com/lists/oss-security/2010/01/02/1
Source: secalert@redhat.com
Mailing List Patch
http://www.openwall.com/lists/oss-security/2010/01/07/1
Source: secalert@redhat.com
Mailing List
http://www.openwall.com/lists/oss-security/2010/01/07/2
Source: secalert@redhat.com
Mailing List
http://www.vupen.com/english/advisories/2009/3662
Source: secalert@redhat.com
Permissions Required Vendor Advisory
http://www.vupen.com/english/advisories/2009/3663
Source: secalert@redhat.com
Permissions Required Vendor Advisory
http://www.vupen.com/english/advisories/2010/1020
Source: secalert@redhat.com
Permissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=552483
Source: secalert@redhat.com
Issue Tracking Patch
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10333
Source: secalert@redhat.com
Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17620
Source: secalert@redhat.com
Broken Link
http://d.pidgin.im/viewmtn/revision/info/3d02401cf232459fc80c0837d31e05fae7ae5467
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
http://d.pidgin.im/viewmtn/revision/info/4be2df4f72bd8a55cdae7f2554b73342a497c92f
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
http://d.pidgin.im/viewmtn/revision/info/c64a1adc8bda2b4aeaae1f273541afbc4f71b810
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
http://developer.pidgin.im/viewmtn/revision/diff/3d02401cf232459fc80c0837d31e05fae7ae5467/with/c64a1adc8bda2b4aeaae1f273541afbc4f71b810/libpurple/protocols/msn/slp.c
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.html
Source: af854a3a-2127-422b-91ae-364da2661108
Product
http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033771.html
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List
http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033848.html
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List
http://secunia.com/advisories/37953
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link Vendor Advisory
http://secunia.com/advisories/37954
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link Vendor Advisory
http://secunia.com/advisories/37961
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
http://secunia.com/advisories/38915
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
http://sunsolve.sun.com/search/document.do?assetkey=1-66-277450-1
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1022203.1-1
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
http://www.mandriva.com/security/advisories?name=MDVSA-2010:085
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
http://www.openwall.com/lists/oss-security/2010/01/02/1
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List Patch
http://www.openwall.com/lists/oss-security/2010/01/07/1
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List
http://www.openwall.com/lists/oss-security/2010/01/07/2
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List
http://www.vupen.com/english/advisories/2009/3662
Source: af854a3a-2127-422b-91ae-364da2661108
Permissions Required Vendor Advisory
http://www.vupen.com/english/advisories/2009/3663
Source: af854a3a-2127-422b-91ae-364da2661108
Permissions Required Vendor Advisory
http://www.vupen.com/english/advisories/2010/1020
Source: af854a3a-2127-422b-91ae-364da2661108
Permissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=552483
Source: af854a3a-2127-422b-91ae-364da2661108
Issue Tracking Patch
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10333
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17620
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link

48 reference(s) from NVD

Quick Stats

CVSS v3 Score
7.5 / 10.0
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-22

Affected Vendors

suse adium fedoraproject redhat pidgin opensuse

Related CVEs

CVE-2026-41279 N/A
CVE-2026-41278 N/A
CVE-2026-41277 N/A
CVE-2026-41276 N/A
CVE-2026-41275 N/A